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Abstract 

We show that the class QMA does not change even if we restrict Arthur’s computing ability 
to only Clifford gate operations (plus classical XOR gate). The idea is to use the fact that the 
preparation of certain single-qubit states, so called magic states, plus any Clifford gate operations 
are universal for quantum computing. If Merlin is honest, he sends the witness plus magic states 
to Arthur. If Merlin is malicious, he might send other states to Arthur, but Arthur can verify the 
correctness of magic states by himself. We also generalize the result to QIP[3]: we show that the 
class QIP[3] does not change even if the computational power of the verifier is restricted to only 
Clifford gate operations (plus classical XOR gate). 
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I. INTRODUCTION 


In classical interactive proof, many results have been obtained on the complexities of 
restricted verihers. For example, Ref. [1] surveys the studies of the case when the veriher 
is restricted to log-space computing. In quantum interactive proof, on the other hand, we 
have more options for restricting the veriher’s ability. For example, we can assume that 
the veriher can perform some restricted set of gates, or even that the veriher is classical. 
Most of the researches so far on such restricted quantum interactive proof have been done 
for the multi-prover case or the case allowing multi-communications between the prover 
and veriher [2, 3], and therefore the simplest case, namely, a single prover and a single 
communication, is not well understood. 

The purpose of the present paper is to study the class QMA with a restricted veriher. 
QMA (Quantum Merlin-Arthur) is a quantum analog of NP (or, more precisely, MA (Merlin- 
Arthur)) dehned by Kitaev [4] and Watrous [5] (also discussed by Knill [6]). The prover, 
called Merlin, has unbounded computational power and the veriher, called Arthur, can 
perform polynomial-time universal quantum computing by using a polynomial-size quantum 
state (so called a witness) sent from Merlin. For a yes instance, Arthur accepts the witness 
with high probability, and for a no instance, any Merlin’s witness is rejected by Arthur with 
high probability. The formal dehnition of QMA is as follows: 


Definition 1. A promise problem A = (Ayesj^no) 'Is in QMA if and only if there exist 
polynomials p, q, and a polynomial-time uniform family {Qx} of quantum circuits, where 
X E A is the input with |x| = n, Qx takes as input a p{n)-qubit quantum state (so called the 
witness), and q{n) ancilla qubits in state such that 

1. Completeness: if x E Ayes, then there exists a p{n)-qubit quantum state \w) such that 
Qx accepts |tc) with probability at least a. 


2. Soundness: if x E Ano, then for any p{n)-qubit quantum state Q Qx accepts f with 
probability at most b. 


Here, a — b > 


1 

poly(n) ■ 


In this dehnition, it is assumed that Arthur can perform universal quantum computing. In 
this paper, we investigate what if Arthur is restricted to apply only Clihord gate operations 
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(plus universal classical computing). Here, Clifford gate operations are operations generated 
hy H = |+)(0| + |—)(1|, S = |0)(0| + *|1)(1|, and CZ = |0)(0| ® I + |1)(1| ® Z, where 
|±) = :^(|0) ± |1)), / = |0)(0| + |1)(1| is the two-dimensional identity operator, and Z = 
|0)(0| — |1)(1| is the Pauli Z operator. In this restriction, Arthur’s computational power 
is restricted to be classical in some sense [7] as the Gottesman-Knill theorem [8] says that 
Clifford gate operations (plus universal classical computing) are classically simulable. We 
show that such a restriction nevertheless does not change the power of QMA. In other words, 
we show 


Theorem 2. QMAcjjgQj.^ = QMA. 

Here, QMAQjjg-Qj.^ is dehned as follows: 

Definition 3. The definition of QMAQjjgQj,^ is the same as that of QMA except that “a 
polynomial-time uniform family {Qx} of quantum circuits” is replaced with “a polynomial¬ 
time uniform family {14} of quantum circuits that consist of 

1. Preparation of \0). 

2. Measurements in the Z basis (at any time during the computation). 

3. Clifford gates (that can be classically controlled by the previous measurement results). ” 


Note that, for simplicity, we assume that Arthur can also perform classical XOR gate. It is 
known that the generation of the three-qubit GHZ state (which can be done with the prepa¬ 
ration of and applications of H and CZ), adaptive Pauli measurements (which can 

be done with the classically controlled H, and the Z-basis measurements), and the classical 
XOR gate are universal for classical computing [9]. 


Our idea to show the theorem is to use the fact that the preparation of many (i.e., 
polynomial in the input size) copies of the single-qubit state. 




1 r 




= (single) - cos ^ 11))(^ sin ^(0| 



so called a magic state, plus any Clifford gate operations are universal for quantum com¬ 
puting [10, 11]. Here, X = |0)(1| -|- |1)(0| is the Pauli X operator. Therefore, Arthur needs 
only Clifford gate operations if he asks Merlin to add magic states to the witness. One 
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problem is that, for a no instance, Arthur cannot trust Merlin: Merlin might send other 
states pretending to be sending magic states. Therefore, Arthur has to do some test such 
that if the state sent from Merlin passes the test, then the output of the test is guaranteed 
to be close to magic states with a sufficiently small significance level. We show that such a 
test does exist, and therefore QMA(-.ijg-Qj.(j = QMA. 

The idea can also be applied to QIP (Quantum Interactive Proof), which is a generaliza¬ 
tion of QMA where many quantum messages can be exchanged between Merlin (the prover) 
and Arthur (the veriher). QIP was dehned by Watrous in Ref. [12], and it is known that 
QIP [3] = QIP = PSPACE [13, 14], where QIP [A:] means that the prover and the verifier can 
exchange quantum messages k times (hence QMA = QIP[1]), and QIP = Uk=poiy{n)Q}P[k]- 
We show QIP [3]Clifford = QIP [3], where QIP [3]Clifford is defined in a similar way as QMAciifjord- 
the verifier of QIP[3] is restricted to only Clifford gate operations (plus classical XOR gate). 

Finally, it is interesting to compare our result on QMA with QCMA. QCMA is a variant 
of QMA where the witness sent from Merlin is not a quantum state but a classical bit 
string. Since the three operations in Definition 3 are classically simulable (the Gottesman- 
Knill theorem [ 8 ]), we obtain QOMAcufjord ^ Here, QCMAcHfford is dehned in a similar 
way as QMAcHfford- Arthur is restricted to Clifford gates (plus the classical XOR gate). 

II. MAGIC STATE TEST 

Let us consider the following test, which we call the magic state test 

1. Let Di be a ( 2 r(? 7 ,)-|-s(? 7 ,)-|-/(n)-|-p(? 7 ,))-qubit system, where r, s, I, and p are polynomials 
specihed later. 

2. Let 02 be the subsystem of Oi consisting of the hrst {2r{n) -|- s{n) + l{n)) qubits of 
Oi. 

3. We randomly choose (2r(n) -|- s(n)) qubits from O 2 . Let O 3 be the system of thus 
chosen ( 2 r(n) + s{n)) qubits. 

4. We further randomly choose 2r(n) qubits from O 3 , and divide thus chosen 2r{n) qubits 
into two r(n)-qubit groups. Si and S 2 . We measure each qubit of Si {S 2 , resp.) in 
X (Z, resp.) basis. Let x and 2 ; be the number of obtaining -|-1 results for X and 
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Z measurements, respectively. If x and 2 : are larger than F{Si,d 2 ,r{n)), the test is 
passed, where F{ 6 i, 62 ,r{n)) is the maximum value satisfying 


F(Si,52,r{n)) 

s,> 

k=0 





1 \ r(n)—k 


Here, (5i and S 2 are specihed later. 

5. Let a be the state of s(n) qubits of ^3 that were not measured. 

We can show that the correct magic states pass the magic state test with high probability, 
and that if we pass the magic state test, a is close to the correct magic states. More precisely, 
we can show the following lemma. (Its proof is given in Appendix A.) 

Lemma 4. We take 82 = choose as We also take r{n) as 

’■<"> = (L|idv/8(4-'(t) + (1) 


where e is any constant, and 


Finally, we take I as 


<h(a:) 



1 -H , 

,— e 2 dt. 


' 2 ( 2 r(? 7 .) + s(n) — 1)2 log 2 ^ 1 


l{n) 


2000 


Then, we have the following items. 


( 2 ) 


(i) If 

p = |i^)(//|®2r(n)+s(n)+i(n) ^ 

we pass the magic state test with probability 1 — e — o(l) for any p{n)-gubit state f. 

(ii) Furthermore, for any state p of hli, if we pass the magic state test, we can guarantee 

that 

> 1 - ^ (3) 

with the significance level A, 


5 











(Note that the signihcance level is the maximum passing probability when malicious 
Merlin sends incorrect states so that the resultant state a does not satisfy Eq. (3) [15]. ) 
We can also show the following lemma (its proof is given in Appendix B), which will be 
used later: 

Lemma 5. Let p be a state in LLi (8) 'H 2 , where "Hi and 7^2 Hilbert spaces. For any 
|x) G Hi, 

max F{\x){x\ (g) p', = F(|a:)(x|, Tr 2 (p))^, (4) 

p'&'H2 

where F{ai,a 2 ) = Tr|i/dqy^| is the fidelity between Oi and 02 , and Tt 2 is the partial trace 
over H 2 . 

III. PROOF OF THE THEOREM 

Now let us show our main result. 

Proof of Theorem 2: C QMA is obvious. Let us show QMA( 2 ;i.g-Qj.j D QMA. 

We assume that a promise problem A is in QMA. Then, there exist a polynomial-time 
uniform family {Qx} of quantum circuits, and the p(?7.)-qubit witness state \w) that is 
accepted by Arthur with probability at least a if x G Ay^s, while any p(?7,)-qubit state is 
accepted with probability at most fe if x G Ano- Here we can take a = § and b = ^. Let 
I 4 be a quantum circuit satisfying the conditions of Dehnition 3 and simulating Qx exactly 
by the method in Ref. [10], and let s{n) be the number of magic states consumed for this 
simulation. 

Arthur runs the following protocol: 

1. Arthur receives a (2r(n) + s{n) + fin) -|-p(n))-qubit state p from Merlin. If Merlin is 
honest, 

p = |i;f)(i^|®2r(n)+s(n)+Z(n) ^ 

If he is malicious, p can be any state. 

2. Arthur does the magic state test on p. 

3. If p fails to pass the test, Arthur rejects. 
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4. If p passes the test, Arthur now has an (s(n) +p(n))-qubit state. The hrst s{n) qubits 
are used as magic states to simulate Qx with 14, and the state of the last p{n) qubits 
is used as the witness for Qx- 

First, we consider the case when x G Ayes- In this case. Merlin sends correct magic states, 
and therefore the probability of passing the test is 1 — ^ from Lemma 4, where we take 
e = A. Therefore, Arthur’s acceptance probability pacc is 

f 1 \ 9a , 

Pace >ax 1- = — = a . 

Face _ 10/10 

Next let us consider the case when x G Ano- Arthur’s acceptance probability Pacc is 


Pace = Tr(C'a;?]) X F(pass the test) 

for a certain POVM element Cx such that the corresponding POVM depends on x and is 
implementable with only Clifford gates, where rj is the {s{n) +p(n))-qubit state after passing 
the magic state test, and P(pass the test) is the probability of passing the magic state test. 
From Eqs. (3) and (4), and the relation. 


2 IIP 1 - P 2 II 1 < \/l - P(pi,p 2 )^ 

between the fidelity and the trace distance (e.g., Eq. (6.106) of Ref. [16]), p satisfies 




1 

< — 
1 - 10 


with probability 1 — for a certain p(n)-qubit state 4 Then, 


ATiCxV)-AT[Cxm{Hr^''^®0] < TTiCxV)-Tr[Cxm{Hr^"^®0 

1 


< - 
- 2 
1 

< — 
“ 10 




Therefore, 


Pace 


= Tr(C' 3 ;r 7 )P(pass the test) 
< Tr{Cxp) 


< — Tr 
- 10 




+ 1 ^) 
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96 9 1 ,, 

<-^-^- = b . 

- 10 100 10 


Since a = | and b = \, 


Therefore, L is in QMA, 


, 9a 9b 9 1 

“ 10 ~ 10 ~ 100~10 
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Clifford- 


100 


IV. QIP 


We can apply our idea to QIP. Let us consider QIP[3]. First, the prover applies a unitary 
map Vi on the a;(n)-qubit state | 0 )p“^"'\ so called the prover’s private register, and the (3{n)- 
qubit state so called the message register, where a and (3 are some polynomials. 

The prover sends the message register of 




p/3(n) 

\m 


to the veriher, where we have used the notation = l^)( 2 ^l- The veriher applies a unitary 
map Vi on the message register plus the 7 (n)-qubit state so called the veriher’s 

private register: 


v.(p.®“'”'®®r)®0' 




j(g)7(n) 


where 7 is a polynomial. The veriher sends the message register to the prover, and the 
prover returns it after applying a unitary map V 2 on the message register plus the prover’s 
private register. Now they share the state 


T’2Vi(T’i([3 


|Cgia(n) 


j(g)7(n) 


where the message register is possessed by the veriher. Finally, the veriher performs a POVM 
measurement on the veriher’s private register plus the message register in order to decide 
the acceptance or rejection. 

In the case of QIP[3]Clifford, the veriher performs the magic state test, which we denote 


T, on (the message part of) the state T’i(l _0 


8)a(n) 


_0_^^ ^). Let Cx be the POVM element 


applied by the veriher that corresponds to the acceptance. (The corresponding POVM 






depends on x and is implementable with only Clifford gate operations.) Then, in the similar 
way as in the case of QMA, we can show 


< 


Tr 

1 

2 

1 






-Tr 




JV 


p. V, ™ ( 0 r ® ED ® V, ^0^0; 


Jy 




< 
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where ^ is a state of a part of the message register and prover’s private register. Then by 
using a similar argument of QMA, we can show QIP[3] C QIP [3]Clifford- 

For QIP[2], we do not know whether QIP[2] = QIP[2]ciifford holds, since in this case, 
the verifier has to perform a unitary map first, and no magic state is available for the first 
unitary map. 
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Appendix A: Proof of Lemma 4 


Proof of (i): The condition (1) is equivalent with 

V 2 s 


26i 




(Al) 


i.e., 


\/^($ ^(e) + $ ^((5i))=r 


26i 

V2s 


This condition implies that 


r I --^ 


2 2 V 2 


- 1 , 


e = r - 


2 2^2/ 


^ ^(1 — e) 


= r - 


1 \ , 25i 


+r- 


^(5i) 


^2 2 V 2 / V2s 

Due to the central limit theorem, the RHS asymptotically equals the quantity F{ 6 i, 62 , r) as 


F(S„S,.r) = r{f-^ + S,)-^- 

[. 

V2s2 Y ( 


(2 “ iTS +'^2)(2 + - <^ 2 ) 




2 2 V 2 V2i 


1 _Dvi _ 

2 2V2R2 2^2 




= r(- -- 

V2 2v/2/ \/2s ^ 

where = means that both sides equal up to a 0(1) additive factor. Hence, again due to the 
central limit theorem, the accepting probability with the true state jg calculated 

as 

F{5i,S2,r) 


E 

x=0 


r\/l 1\^/1 1\ 

+ 


xj \2 2^2^ V2 2 V 2 


)+^/87$-l(e) 


E 

x=0 


r\ /I 1 /I 


xj\2 2^27 V2 2^27 


- + 


\ r—x 


\ r—x 

= 1 - e, 


which implies Item (i), where = means that both sides equal up to a o(l) additive factor. 
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Proof of (a): To show Item (ii), let P' be the POVM element on the composite system of Si 
and S 2 corresponding to passing the test. We dehne the operator P = P' ® [I — \ H®^) 
that corresponds to the incorrect decision. To bound the probability of incorrect decision, 
we prepare the following lemma. 


Lemma 6. Any state p on the system satisfies 


Tr Pp < max{2(5i, SV 2 S 2 } + 


2(2r + s- l)2 1og2 

I ■ 


(A2) 


The proof of this lemma is given later. 

The meaning of the value TrPp is the following. We £x a small real number h > 
0. If the resultant state a' with the acceptance satishes <1 — 5, i.e., 

Tr cr'(/ — > 5, the probability of the acceptance is less than |TrPp because 

Tr Fp > 5Tr (P' $§ I)p. In other words, the resultant state a' with the acceptance satishes 
(P®*|cr'|P®^) >1 — 5 with the signihcance level maXp iTrPp. 

Let us choose 62 as and 5 as Then, 


Tr Pp < 25i + 


2(2r + s- l)2 1og2 
I ' 


(A3) 


Combining the relation (2) and 5i < we can evaluate the signihcance level as 

maXp |Tr Pp < j.e., we obtain Item (ii). 

Proof of Lemma 6 : Firstly, we consider the case when the true state p is a tensor product 
state cr® 2 r-+s_ x and z are larger than P(5i, 52, r), we can conclude that 



(A4) 

Tr ((t|0)(0|) < 2 2 ^ 2 ^*^^’ 

(AS) 

So, if (A4) and (AS) do not hold. 



Tr(j®2rp/ < 25 i . 


(A6) 


On the other hand, the relations (A4) and (AS) are equivalent with 

'IVWI+)(+|-|-)(-|))<-^ + 2^2, (A7) 

lVK|0)(0|-|l>(l|))<-^ + 2i2. (A8) 
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That is, 


TrfT|//)(Tr| = Tra^[j-^(X + Z)l > 1 - x/2h2, 

I L 'y/2 


(A9) 


which implies that 


> (1 - 72^)* > 1 - s\/2i2. 


(AlO) 


Therefore, if (A4) and (A5) hold, (AlO) holds, i.e., 

< sV262. 

Combining (A6) and (All) implies that 

TrP^® 2 r+s _ (Tra^^'-p') . (Tra®"(/ - |P®")(P®*|)) < max{2(5i, sV^^s}- 


(All) 


(A12) 


Since we randomly choose samples, we can assume that the total system is permutation 
invariant. Hence, we can apply the quantum de Finetti theorem to his. In particular, our 
measurements are one-way LOCC. So, we can apply the equation (2) in [17]. For the state 
p in fla, there exists a distribution Q on the qubit space iS(C^) such that 


TrPp-TrP j 


/2(2r + s- l)2 1og2 


(A13) 


(A12) yields that 


Tr P / (5(cr)(T®^'’'''^(icr < max{25i, s\/2h2}- 


(A14) 


Thus, (A13) and (A14) guarantee (A2). 


Appendix B: Proof of Lemma 5 

Note that {x\p\x) is a non-negative hermitian matrix on 'H 2 - Let us define the state 

1 , , , . 1 


P”^ 


Tr 2 (x|p|x) 


{x\p\x) = 


(x|Tr2p|x) 


{x\p\x). 


Then, 


F{\x){x\® p ,pf = \^T\^/\x){x\W/y^/p\ 

= (^Tr ||x)(a:| (g) V^\/pl) 
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= ^Tr y^|a;)(x| (g) ^J~p'p\x){x\ ® 
= (^Tr |x)(x| (g) \l^/p'{x\p\x) 

= (Ti ^V7(a^|p|a;)v^) 

= (^Tr \l ^p"^(a:|Tr2p|x) j 

= (^Tr \l{x\Ti2p\x) 
= F{p\p"f{x[Ii2p\x) 

< {x\Ti2p\x), 

where the equality holds when p' = p". 
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